# changelog

author: liuzhilin <liuzhilin@uniontech.com> - 1:1.44.2-2
changelog:
  - add NM to support wifi6(fix dde-network-core build error)
  - Type:requirement
  - CVE:NA
  - SUG:NA
  - DESC:Support wireless networks connecting WIFI6 encryption methods,
         so this demand is achieved in NetworkManager, KF5-NetworkManager-QT,
         DDE-Network-Core software package


author: qinxue <qinxue6@h-partners.com> - 1:1.44.2-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:mptcp fix error handling rp_filter when kernel don't support mptcp


author: Li Nan <linan122@huawei.com> - 6.6.0-101.0.0.107
changelog:
  - !17041 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.70-6.6.72 LTS Conflicts Patches
  - !17126  EDAC/skx_common: Fix general protection fault
  - !17136  xcall xint 644
  - modify xcall proc file permissions to 640
  - modify xint proc file permissions to 640
  - !17070  arm64/mpam: Add quirk for MPAM MSMON_MBWU monitor NRDY bit
  - !17106  arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  - !17120 v3  mm: batched unmap lazyfree large folios
  - EDAC/skx_common: Fix general protection fault
  - mm/rmap: fix potential out-of-bounds page table access during batched unmap
  - mm: avoid splitting pmd for lazyfree pmd-mapped THP in try_to_unmap
  - mm: support batched unmap for lazyfree large folios during reclamation
  - mm: support tlbbatch flush for a range of PTEs
  - mm: set folio swapbacked iff folios are dirty in try_to_unmap_one
  - !16998  arm64/mpam: Fix L2 monitor issue under CDP mode
  - !17107  CVE-2025-38322
  - !16947 [OLK-6.6] Fix patches for X2avic to backport for OLK-6.6
  - !17092  drm/amd/display: Fix && vs || typos
  - perf/x86/intel: Fix crash in icl_update_topdown_event()
  - perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read
  - perf/x86/intel: Apply static call for drain_pebs
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  - !16884  fs: Backport four namespace fix patches
  - !17094  config: Set TSM_REPORTS=m and ARM_CCA_GUEST=m
  - config: Set TSM_REPORTS=m and ARM_CCA_GUEST=m
  - drm/amd/display: Fix && vs || typos
  - !17071  usb: dwc3: gadget: check that event count does not exceed event buffer length
  - !17068  mcb: fix a double free bug in chameleon_parse_gdd()
  - !17062  bnxt_en: Mask the bd_cnt field in the TX BD properly
  - !16956 v3  config: Enable CONFIG_VIRT_DRIVERS
  - !16950 perf: Add support for SPE Data Source packet on HiSilicon HIP12
  - usb: dwc3: gadget: check that event count does not exceed event buffer length
  - arm64/mpam: Add quirk for MPAM MSMON_MBWU monitor NRDY bit
  - mcb: fix a double free bug in chameleon_parse_gdd()
  - bnxt_en: Mask the bd_cnt field in the TX BD properly
  - !17055  bpf lts backport
  - !17054  bpf verifier fixes
  - !17049  platform/x86: dell_rbu: Fix list usage
  - !17059  media: cxusb: no longer judge rbuf when the write fails
  - !16462 fix  CVE-2025-22101
  - media: cxusb: no longer judge rbuf when the write fails
  - bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types
  - bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
  - selftests/bpf: Add tests with stack ptr register in conditional jmp
  - bpf: Do not include stack ptr register in precision backtracking bookkeeping
  - selftests/bpf: precision tracking test for BPF_NEG and BPF_END
  - platform/x86: dell_rbu: Fix list usage
  - fs/Kconfig: make hugetlbfs a menuconfig
  - workqueue: Update lock debugging code
  - memblock: use numa_valid_node() helper to check for invalid node ID
  - perf mem: Count L2 HITM for c2c statistic
  - perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12
  - arm64: cputype: Add cputype definition for HIP12
  - Revert "perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12"
  - arm64/mpam: Fix L2 monitor issue under CDP mode
  - KVM: x86: Fix a comment inside __kvm_set_or_clear_apicv_inhibit()
  - config: Enable CONFIG_VIRT_DRIVERS
  - KVM: x86: Only set APICV_INHIBIT_REASON_ABSENT if APICv is enabled
  - iommu/amd: Do not flush IRTE when only updating isRun and destination fields
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
  - do_change_type(): refuse to operate on unmounted/not ours mounts
  - fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2)
  - path_overmount(): avoid false negatives
  - net: libwx: fix Tx L4 checksum


author: Li Nan <linan122@huawei.com> - 6.6.0-102.0.0.108
changelog:
  - !17076  smb: client: fix use-after-free in crypt_message when using async crypto
  - !17102  smb: client: fix use-after-free in cifs_oplock_break
  - !17240  some fix for spe hotcold
  - !17159 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.72-6.6.75 LTS Conflicts Patches
  - !17206  driver core: Use kasprintf() instead of fixed buffer formatting
  - mm_monitor/mm_spe: Embed boost events within SPE packets
  - mm_monitor/mm_spe: Fix SPE boost enablement and continuation handling
  - !17161  olk-6.6-backport-bugfix-for-dynamic-affinity
  - !17150  HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
  - !17153  f2fs: prevent kernel warning due to negative i_nlink from corrupted image
  - !17154  media: vivid: Change the siize of the composing
  - !17238 v2  net: Fix kabi breakage for defer_free_list in struct net
  - !17237 RDMA/hns: Fix HW configurations not cleared in error flow
  - net: Fix kabi breakage for defer_free_list in struct net
  - RDMA/hns: Fix HW configurations not cleared in error flow
  - RDMA/hns: Fix -Wframe-larger-than issue
  - RDMA/hns: Drop GFP_NOWARN
  - RDMA/hns: Fix accessing uninitialized resources
  - RDMA/hns: Remove redundant hnae3.h in bond and sysfs
  - RDMA/hns: Use __free_page() to free pages allocated with alloc_page()
  - RDMA/hns: Fix divide-by-zero error in dca debugfs
  - RDMA/hns: Add check between dca_min_size and dca_max_size
  - RDMA/hns: Get messgae length of ack_req from FW
  - !17229 net: hns3: fix spelling mistake "reg_um" -&gt; "reg_num"
  - !17032  fbcon: Make sure modelist not set on unregistered console
  - !16958  scsi: target: iscsi: Fix timeout on deleted connection
  - net: hns3: fix spelling mistake "reg_um" -> "reg_num"
  - net: hns3: add complete parentheses for some macros
  - net: hns3: use hns3_get_ops() helper to reduce the unnecessary middle layer conversion
  - net: hns3: use hns3_get_ae_dev() helper to reduce the unnecessary middle layer conversion
  - net: hns3: delete redundant address before the array
  - net: hns3: clear hns alarm: comparison of integer expressions of different signedness
  - net: hns3: add \n at the end when print msg
  - Revert "net: hns3: add \n at the end when print msg"
  - !17201 net: hns3: reduce stack usage in hclge_dbg_dump_tm_pri()
  - !17215  net_sched: sch_sfq: fix a potential crash on gso_skb handling
  - !17214  netfilter: nf_set_pipapo_avx2: fix initial map fill
  - !17213  net: fix udp gso skb_segment after pull from frag_list
  - !17212  ice: fix Tx scheduler error handling in XDP callback
  - !17207  net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
  - !17200  xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()
  - !17199  tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
  - !17198  bpf: consider that tail calls invalidate packet pointers
  - !17197  net: stmmac: Fix accessing freed irq affinity_hint
  - !17196  mptcp: fix NULL pointer in can_accept_new_subflow
  - !17194  tipc: fix memory leak in tipc_link_xmit
  - !17193  net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered
  - !17192  cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
  - !17184  sctp: add mutual exclusion in proc_sctp_do_udp_port()
  - !17181  net: fix NULL pointer dereference in l3mdev_l3_rcv
  - !17101  jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
  - !17191  net: mctp: Set SOCK_RCU_FREE
  - !17190  usbnet:fix NPE during rx_complete
  - !17189  net: ibmveth: make veth_pool_store stop hanging
  - !17188  arcnet: Add NULL check in com20020pci_probe()
  - !17187  net: fix geneve_opt length integer overflow
  - !17186  udp: Fix memory accounting leak.
  - !17185  net: mvpp2: Prevent parser TCAM memory corruption
  - !17182  net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
  - !17179  net: dsa: free routing table on probe failure
  - !17178  sctp: detect and prevent references to a freed transport in sendmsg
  - !17177  net_sched: hfsc: Fix a UAF vulnerability in class handling
  - !17176  net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
  - !17175  net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported
  - !17174  net: dsa: clean up FDB, MDB, VLAN entries on unbind
  - !17172  xsk: fix an integer overflow in xp_create_and_assign_umem()
  - !17171  net: atm: fix use after free in lec_send()
  - !17170  eth: bnxt: fix truesize for mb-xdp-pass case
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling
  - netfilter: nf_set_pipapo_avx2: fix initial map fill
  - net: fix udp gso skb_segment after pull from frag_list
  - ice: fix Tx scheduler error handling in XDP callback
  - net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
  - !17016 [OLK-6.6]:update patches for sw64 architecture
  - driver core: Use kasprintf() instead of fixed buffer formatting
  - !17074  ext4: only dirty folios when data journaling regular files
  - !16951  wifi: ath9k_htc: Abort software beacon handling if disabled
  - net: hns3: reduce stack usage in hclge_dbg_dump_tm_pri()
  - net: hns3: Resolved the issue that the debugfs query result is inconsistent.
  - Revert "net: hns3: Resolved the issue that the debugfs query result is inconsistent."
  - net: hns3: initialize reset_timer before hclgevf_misc_irq_init()
  - Revert "net: hns3: initialize reset_timer before hclgevf_misc_irq_init()"
  - net: hns3: Use ARRAY_SIZE() to improve readability
  - Revert "net: hns3: fix spelling mistake "reg_um" -> "reg_num""
  - xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()
  - tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
  - bpf: consider that tail calls invalidate packet pointers
  - net: stmmac: Fix accessing freed irq affinity_hint
  - mptcp: fix NULL pointer in can_accept_new_subflow
  - tipc: fix memory leak in tipc_link_xmit
  - net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered
  - cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
  - net: mctp: Set SOCK_RCU_FREE
  - usbnet:fix NPE during rx_complete
  - net: ibmveth: make veth_pool_store stop hanging
  - arcnet: Add NULL check in com20020pci_probe()
  - net: fix geneve_opt length integer overflow
  - !16850 [OLK-6.6] Backport TDX HLT/SAFE-HLT fix
  - udp: Fix memory accounting leak.
  - net: mvpp2: Prevent parser TCAM memory corruption
  - sctp: add mutual exclusion in proc_sctp_do_udp_port()
  - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
  - net: fix NULL pointer dereference in l3mdev_l3_rcv
  - net: dsa: free routing table on probe failure
  - sctp: detect and prevent references to a freed transport in sendmsg
  - net_sched: hfsc: Fix a UAF vulnerability in class handling
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
  - net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported
  - net: dsa: clean up FDB, MDB, VLAN entries on unbind
  - !17137 [olk 6.6] net: hibmcge: backport some feature patches
  - xsk: fix an integer overflow in xp_create_and_assign_umem()
  - net: atm: fix use after free in lec_send()
  - eth: bnxt: fix truesize for mb-xdp-pass case
  - !17156  v3:add perpcu stock for kmem
  - scsi: ufs: core: Set default runtime/system PM levels before ufshcd_hba_init()
  - libfs: Fix simple_offset_rename_exchange()
  - shmem: Fix shmem_rename2()
  - mac802154: check local interfaces before deleting sdata list
  - hfs: Sanity check the root record
  - !17109 efi: efi_get_memory_map -- increase map headroom
  - !17148  Bluetooth: MGMT: Protect mgmt_pending list with its own lock
  - sched/dynamic_affinity: Calculate cpu capacity in real time when realtime tasks are running on this cpu
  - sched/dynamic_affinity: fix CI test alway select prefer_cpu problem
  - sched/dynamic_affinity: fix preffered_cpu offline problem
  - sched/fair: reset idlest_cpu if not meet the conditions for preferred CPU
  - memcg: add stock for kmem [un]charging
  - memcg: add CONFIG_MEMCG_KMEM_STOCK
  - scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers
  - selftests: tc-testing: reduce rshift value
  - media: vivid: Change the siize of the composing
  - f2fs: prevent kernel warning due to negative i_nlink from corrupted image
  - !17124  crypto: algif_hash - fix double free in hash_accept
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
  - Bluetooth: MGMT: Protect mgmt_pending list with its own lock
  - net: hibmcge: configure FIFO thresholds according to the MAC controller documentation
  - net: hibmcge: adjust the burst len configuration of the MAC controller to improve TX performance.
  - net: hibmcge: support scenario without PHY
  - net: phy: fixed_phy: constify status argument where possible
  - net: phy: fixed_phy: remove irq argument from fixed_phy_register
  - efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32
  - net: phy: fixed_phy: remove irq argument from fixed_phy_add
  - net: phy: fixed_phy: remove fixed_phy_register_with_gpiod
  - !17140 v2  Cgroup-Based Interference Statistics followup
  - interference: Add distribution histogram support
  - interference: Use hardware timer counter
  - interference: Add mutex interference track support
  - interference: Add spinlock interference track support
  - interference: Add cgroup_ifs_enter/leave_lock helper
  - interference: Disable irq track when irqtime disabled
  - sw64: delete useless I/O access in VM and emulator
  - sw64: kvm: fix perf kvm support
  - sw64: Kconfig: enable HAS_IOPORT by default
  - sw64: pci: remove zx200 dma mask reset
  - sw64: fix for executing syscall(-1)
  - sw64: acpi: select HAVE_ACPI_APEI when ACPI is set
  - sw64: pci: add base address of devmn
  - sw64: adjust the notrace in the code
  - crypto: algif_hash - fix double free in hash_accept
  - smb: client: fix use-after-free in cifs_oplock_break
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
  - smb: client: fix use-after-free in crypt_message when using async crypto
  - ext4: only dirty folios when data journaling regular files
  - Fix kabi for TDX halt/safe-halt
  - fbcon: Make sure modelist not set on unregistered console
  - sw64: irqchip: update effective affinity for PINTC
  - sw64: irqchip: add support for PINTC on all NUMA nodes
  - sw64: cpufreq: optimize the granularity of cpufreq
  - sw64: ftrace: restore the register storing direct call address
  - sw64: kvm: fix undefined compile issues for kvm module
  - sw64: pintc: fix guest pintc init
  - sw64: set module region to the 2GB space below vmalloc area
  - scsi: target: iscsi: Fix timeout on deleted connection
  - wifi: ath9k_htc: Abort software beacon handling if disabled
  - x86/tdx: Fix arch_safe_halt() execution for TDX VMs
  - x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT


author: Li Nan <linan122@huawei.com> - 6.6.0-103.0.0.109
changelog:
  - !17341 v7  arm64: Add hardware xcall framework support
  - !17336  fs/resctrl: Enqueue mon_event_count() forcefully for MPAM
  - !17308  arm64: Fix guest app segment fault when disable_sdei_nmi_watchdog
  - arm64: Add hardware xcall framework support
  - arm64: Reserve a kabi in task_struct exclusively for xcall
  - arm64: Refactor the xcall proc code
  - !17259  mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
  - !17335 ROH: fix security issues and eliminate redundancies
  - ROH: fix security issues and eliminate redundancies
  - arm64/mpam: Ensure the err variable is initialized
  - fs/resctrl: Enqueue mon_event_count() forcefully for MPAM
  - !17261 Fixed the wrong debugfs node name in hisi_spi debugfs initialization
  - !17296  nvmet-tcp: don't restore null sk_state_change
  - !17299  dmaengine: idxd: fix memory leak in error handling path of idxd_alloc
  - !17310  usb: typec: altmodes/displayport: do not index invalid pin_assignments
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments
  - !17305  CVE-2025-38264
  - !17303  sched/fair: Only increment deadline once on yield
  - !17266 unify log function usage of enfs
  - arm64: Fix guest app segment fault when disable_sdei_nmi_watchdog
  - nvme-tcp: sanitize request list handling
  - llist: add interface to check if a node is on a list.
  - !17255  inspector: hold module refcnt when cpu inspector is running
  - !17291  libbpf: Fix null pointer dereference in btf_dump__free on allocation failure
  - sched/fair: Only increment deadline once on yield
  - nfs/enfs: use enfs_log_error() instead of pr_err() in enfs
  - nfs/enfs: use enfs_log_info() instead of pr_info() in enfs
  - nfs/enfs: cleanups in enfs/shard_route.c
  - nfs/enfs: use enfs_log_debug() instead of pr_debug() to debug enfs
  - nfs/enfs: remove unused code in enfs/dns_internal.h
  - nfs/enfs: use enfs_log_debug() instead of dfprintk() to debug enfs
  - nfs: use dfprintk() to debug enfs
  - !17262 v2  ifs: Defer cgroup ifs enable
  - !17287  i40e: fix MMIO write access to an invalid page in i40e_clear_hw
  - dmaengine: idxd: fix memory leak in error handling path of idxd_alloc
  - nvmet-tcp: don't restore null sk_state_change
  - libbpf: Fix null pointer dereference in btf_dump__free on allocation failure
  - !17275  fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw
  - !17273  atm: Revert atm_account_tx() if copy_from_iter_full() fails.
  - fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails.
  - !17246 MPTCP UPTREAM PART25
  - ifs: Defer cgroup ifs enable
  - Fixed the wrong debugfs node name in hisi_spi debugfs initialization
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
  - inspector: hold module refcnt when cpu inspector is running
  - selftests: mptcp: join: validate event numbers(part 2)
  - selftests: mptcp: pm_nl_ctl: remove re-definition
  - selftests: mptcp: join: simplify checksum_tests
  - selftests: mptcp: join: mute errors when ran in the background
  - selftests: mptcp: join: specify host being checked
  - selftests: mptcp: join: more explicit check name
  - selftests: mptcp: join: validate MPJ SYN TX MIB counters
  - selftests: mptcp: join: one line for join check
  - selftests: mptcp: join: reduce join_nr params
  - mptcp: MIB counters for sent MP_JOIN
  - mptcp: pm: reduce entries iterations on connect
  - mptcp: pm: fix backup support in signal endpoints
  - mptcp: pm: rename helpers linked to 'flush'
  - mptcp: Remove unused declaration mptcp_sockopt_sync()
  - !17250  arm64/mpam: Fix incorrect CPU-to-partid binding under CDP mode
  - !17253  mm: fix uprobe pte be overwritten when expanding vma
  - !16602 【OLK-6.6】修复虚拟机下使用海光TKM功能可能返回TKM_UNSUPPORTED_CMD错误
  - !16797 【OLK-6.6】修复psp_mutex_lock_timeout超时触发soft lockup警告的问题
  - mm: fix uprobe pte be overwritten when expanding vma
  - arm64/mpam: Fix incorrect CPU-to-partid binding under CDP mode
  - arm64/mpam: Fix typo in resctrl_arch_set_cdp_enabled()
  - drivers/crypto/ccp: fix soft lockup warning in psp_mutex_lock_timeout()
  - crypto: ccp: fix The high priority queue changes cmd_id of the queued elements


author: Li Nan <linan122@huawei.com> - 6.6.0-104.0.0.110
changelog:
  - !17385 mptcp: pm: only set fullmesh for subflow endp
  - !17445  xdp: Reset bpf_redirect_info before running a xdp's BPF prog.
  - !17444  Backport mainline patch
  - !17395  Squashfs: check return result of sb_min_blocksize
  - xdp: Reset bpf_redirect_info before running a xdp's BPF prog.
  - bonding: check xdp prog when set bond mode
  - bonding: return detailed error when loading native XDP fails
  - !17436  i2c/designware: Fix an initialization issue
  - !17432  ACPICA: Refuse to evaluate a method if arguments are missing
  - !17421  ACPICA: fix acpi operand cache leak in dswstate.c
  - !17422  soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
  - !17423  net: stmmac: make sure that ptp_rate is not 0 before configuring EST
  - !17301  fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
  - !17304  nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
  - !17331  dm-bufio: fix sched in atomic context
  - !17413  CVE-2025-37957
  - !17412 v3  livepatch: support for super-long symbol repositioning
  - !16933  virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
  - !16932  dm: fix unconditional IO throttle caused by REQ_PREFLUSH
  - !17430  drm/v3d: Disable interrupts before resetting the GPU
  - i2c/designware: Fix an initialization issue
  - !17254 irqchip/gic-v3-its: Remove DevID Pool's restriction
  - !17406  usb: net: sierra: check for no status endpoint
  - ACPICA: Refuse to evaluate a method if arguments are missing
  - drm/v3d: Disable interrupts before resetting the GPU
  - !17393  selftests/tracing: Fix false failure of subsystem event test
  - net: stmmac: make sure that ptp_rate is not 0 before configuring EST
  - soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
  - ACPICA: fix acpi operand cache leak in dswstate.c
  - KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception
  - KVM: SVM: Update SEV-ES shutdown intercepts with more metadata
  - livepatch: support for super-long symbol repositioning
  - usb: net: sierra: check for no status endpoint
  - !17380  bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
  - mptcp: pm: only set fullmesh for subflow endp
  - !17115  xfs: fix attr inactive issue
  - Squashfs: check return result of sb_min_blocksize
  - selftests/tracing: Fix false failure of subsystem event test
  - !17390  ipvlan: Fix out-of-bound bugs in ipvlan_xmit_mode_l2e()
  - !17387  ipvlan: ensure network headers are in skb linear part
  - ipvlan: Fix out-of-bound bugs in ipvlan_xmit_mode_l2e()
  - !17205 fix some panic bugs and memory leak bugs of enfs
  - ipvlan: ensure network headers are in skb linear part
  - !17271 LoongArch: KVM: Solve the problem of starting up the upstream qemu
  - !17251 migration: update status after RAS error
  - !17278 nvme: update firmware version after commit
  - !17330  livepatch: fix insn length check
  - irqchip/gic-v3-its: Remove DevID Pool's restriction
  - !17372  drm/amd/display: Add null pointer check for get_first_active_display()
  - !17349  bnxt: properly flush XDP redirect lists
  - !17375  RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
  - !17367  fd/proc: modify xcall proc file permissions to 640
  - !17346  calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
  - !17222  fs: Add additional checks for block devices during mount
  - !17168  xfrm: state: fix out-of-bounds read during lookup
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
  - !17141 CVE-2025-37992：net_sched: Flush gso_skb list too during -&gt;change()
  - !17364  net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
  - !17167  eth: bnxt: always recalculate features after XDP clearing, fix null-deref
  - !17371  ext4: inline: fix len overflow in ext4_prepare_inline_data
  - !17362  ucounts: fix mq_perf test error.
  - drm/amd/display: Add null pointer check for get_first_active_display()
  - ext4: inline: fix len overflow in ext4_prepare_inline_data
  - fd/proc: modify xcall proc file permissions to 640
  - !17361  scsi: lpfc: Use memcpy() for BIOS version
  - !17360  net: Fix CVE-2025-21884
  - !17356  serial: jsm: fix NPE during jsm_uart_port_init
  - net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
  - ucounts: fix mq_perf test error.
  - scsi: lpfc: Use memcpy() for BIOS version
  - net: better track kernel sockets lifetime
  - net: Add net_passive_inc() and net_passive_dec().
  - !17269 MPTCP UPTREAM PART26
  - !17358  serial: mctrl_gpio: split disable_ms into sync and no_sync APIs
  - !17322  Fix CVE-2025-38424
  - serial: mctrl_gpio: split disable_ms into sync and no_sync APIs
  - !17342  tls: always refresh the queue when reading sock
  - !17343  Fix WARN in perf_cgroup_switch()
  - !17080  serial: Fix potential null-ptr-deref in mlb_usio_probe()
  - !17351  mm/dynamic_pool: Fix free_huge_pages undefflow problem
  - !17319  mm/dpool: do not use uninitialized variable
  - serial: jsm: fix NPE during jsm_uart_port_init
  - nfs/enfs: remove unnecessary shard_should_stop in shard_route.c
  - mm/dynamic_pool: Fix free_huge_pages undefflow problem
  - !17345 net: hns3: use seq_file for files in tx_bd_info/ and rx_bd_info/ in debugfs
  - bnxt: properly flush XDP redirect lists
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
  - net: hns3: use seq_file for files in tx_bd_info/ and rx_bd_info/ in debugfs
  - net: hns3: use seq_file for files in common/ of hclge layer
  - net: hns3: use seq_file for files in fd/ in debugfs
  - !17328  perf: Revert to requiring CAP_SYS_ADMIN for uprobes
  - perf/core: Fix the WARN_ON_ONCE is out of lock protected region
  - perf/core: Fix WARN in perf_cgroup_switch()
  - !17324  video: screen_info: Relocate framebuffers behind PCI bridges
  - tls: always refresh the queue when reading sock
  - nvme-host: fix the updating of the firmware version
  - nvme: update firmware version after commit
  - net: hns3: use seq_file for files in reg/ in debugfs
  - net: hns3: use seq_file for files in mac_list/ in debugfs
  - net: hns3: use seq_file for files in tm/ in debugfs
  - net: hns3: use seq_file for files in common/ of hns3 layer
  - net: hns3: use seq_file for files in queue/ in debugfs
  - net: hns3: clean up the build warning in debugfs by use seq file
  - net: hns3: remove tx spare info from debugfs.
  - net: hns3: use string choices helper
  - dm-bufio: fix sched in atomic context
  - livepatch: fix insn length check
  - perf: Revert to requiring CAP_SYS_ADMIN for uprobes
  - video: screen_info: Relocate framebuffers behind PCI bridges
  - LoongArch: KVM: Enhance the robustness of extioi
  - perf/core: Fix WARN in perf_sigtrap()
  - perf: Fix sample vs do_exit()
  - mm/dpool: do not use uninitialized variable
  - mptcp: sysctl: blackhole timeout: avoid using current->nsproxy
  - mptcp: blackhole only if 1st SYN retrans w/o MPC is accepted
  - doc: mptcp: sysctl: blackhole_timeout is per-netns
  - mptcp: sysctl: avail sched: remove write access
  - mptcp: remove unneeded lock when listing scheds
  - nfs/enfs: remove enfs_uuid_debug in shard_route.c
  - nfs/enfs: remove usage of list_entry_is_head() in shard_route.c
  - sunrpc: remove redundant rpc_task_release_xprt() of enfs
  - nfs/enfs: remove judgement about enfs_option in nfs_multipath_client_info_init()
  - nfs/enfs: remove nfs_multipath_client_info_free_work()
  - nfs/enfs: fix typos in shard_route.c
  - nfs/enfs: remove unused functions in shard_route.c
  - nfs/enfs: make some functions static in shard_route.c
  - nfs/enfs: introduce DEFINE_PARSE_FH_FUNC to define parse_fh()
  - nfs/enfs: fix memory leak when free view_table
  - nfs/enfs: use DEFINE_CLEAR_LIST_FUNC to define enfs_clear_shard_view()
  - nfs/enfs: introduce DEFINE_CLEAR_LIST_FUNC to define enfs_clear_fs_info()
  - nfs/enfs: fix memory leak in enfs_delete_fs_info()
  - nfs/enfs: fix double free of multipath_client_info
  - nfs/enfs: fix null-ptr-deref in shard_update_work()
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
  - fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
  - LoongArch: KVM: Solve the problem of starting up the upstream qemu
  - drivers/iommu: Fix the initialization failure issue of the iommu module
  - LoongArch: KVM: Fix the extioi simulation error
  - netlink: specs: mptcp: fix port endianness
  - mptcp: disable active MPTCP in case of blackhole
  - mptcp: include inet_common in mib.h
  - mptcp: move mptcp_pm_gen.h's include
  - mptcp: remove unnecessary else statements
  - mptcp: prefer strscpy over strcpy
  - mptcp: add net.mptcp.available_schedulers
  - mptcp: sockopt: info: stop early if no buffer
  - mptcp: fallback to TCP after SYN+MPC drops
  - mptcp: export mptcp_subflow_early_fallback()
  - selftests: mptcp: connect: remove duplicated spaces in TAP output
  - selftests: mptcp: diag: remove trailing whitespace
  - selftests: mptcp: test last time mptcp_info
  - mptcp: add last time fields in mptcp_info
  - selftests: mptcp: reset the last TS before the first test
  - selftests: mptcp: netlink: drop disable=SC2086
  - selftests: mptcp: ip_mptcp option for more scripts
  - selftests: mptcp: use pm_nl endpoint ops
  - selftests: mptcp: export pm_nl endpoint ops
  - selftests: mptcp: join: update endpoint ops
  - selftests: mptcp: netlink: add change_address helper
  - selftests: mptcp: add {get,format}_endpoint(s) helpers
  - selftests: mptcp: netlink: add 'limits' helpers
  - selftests: mptcp: add tc check for check_tools
  - selftests: mptcp: connect: remote time in TAP output
  - selftests: mptcp: lib: add time per subtests in TAP output
  - migration: update status after RAS error
  - Revert "migration: update status after RAS error"
  - fs: Add additional checks for block devices during mount
  - xfrm: state: fix out-of-bounds read during lookup
  - eth: bnxt: always recalculate features after XDP clearing, fix null-deref
  - net_sched: Flush gso_skb list too during ->change()
  - xfs: handle attr node/leaf blocks atomically during inactive
  - xfs: factor out xfs_attr3_leaf_init
  - xfs: factor out xfs_da3_node_entry_remove
  - Revert "xfs: factor out __xfs_da3_node_read()"
  - Revert "xfs: atomic drop extent entries when inactiving attr"
  - serial: Fix potential null-ptr-deref in mlb_usio_probe()
  - virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
  - dm: fix unconditional IO throttle caused by REQ_PREFLUSH


author: Li Nan <linan122@huawei.com> - 6.6.0-105.0.0.111
changelog:
  - !17513  sched-ebpf-add-for-exec-init
  - !17487  arm64/mpam: Support partial-core boot for MPAM
  - !16844  LeapIOraid: add device and support fw log
  - sched/bpf: Fix kabi breakage for including sched bpf header file
  - sched/ebpf: Add kfunc to set the preferred NUMA node for the task
  - sched/ebpf: Add bpf_sched_cfs_exec_set_cpumask hook
  - !17512  CVE-2025-21868
  - !17498  sched: Support NUMA parallel scheduling for multiple processes
  - !17508  Huawei iBMA: Added support for Hi1712 Chip
  - hv_netvsc: Preserve contiguous PFN grouping in the page buffer array
  - net: use __GENKSYMS__ to revert the kabi change
  - net: allow small head cache usage with large MAX_SKB_FRAGS values
  - Huawei iBMA: Added support for Hi1712 Chip
  - !17501 net: hibmcge: fix rtnl deadlock issue
  - net: hibmcge: fix rtnl deadlock issue
  - net: hibmcge: fix the division by zero issue
  - net: hibmcge: fix the np_link_fail error reporting issue
  - !17459 ROH: fix variable type inconsistency issue
  - sched: Support NUMA parallel scheduling for multiple processes
  - !17183  rtnetlink: Allocate vfinfo size for VF GUIDs when supported
  - !17180  atm: Fix NULL pointer dereference
  - !16807 Support RME feature for CCA host
  - !17488  arm64/mpam: Set 1 as the minimum setting value for CMAX
  - arm64/mpam: Set 1 as the minimum setting value for CMAX
  - arm64/mpam: Support partial-core boot for MPAM
  - !17440  sdei_watchdog: use lockup_detector_retry_init() to init sdei watchdog
  - VirtCCA: Compatible with virtcca macro definitions
  - CCA: Fix cca kabi conflict
  - VirtCCA: Modify openeuler_defconfig
  - Reapply "VirtCCA: cvm support UEFI boot"
  - VirtCCA: Adapt virtcca operations by cca_base.
  - VirtCCA: Adapt realm operations by cca_base.
  - VirtCCA: Add CCA base operations.
  - [v8-43-43]KVM: arm64: Allow activating realms
  - [v8-42-43]KVM: arm64: Expose KVM_ARM_VCPU_REC to user space
  - [v8-40-43]arm64: RME: Provide accurate register list
  - [v8-39-43]arm64: RME: Provide register list for unfinalized RME RECs
  - [v8-38-43]rm64: RME: Configure max SVE vector length for a Realm
  - [v8-37-43]arm64: RME: Propagate max SVE vector length from RMM
  - [v8-36-43]arm64: RME: Initialize PMCR.N with number counter supported by RMM
  - [v8-35-43]arm64: RME: Set breakpoint parameters through  SET_ONE_REG
  - [v8-34-43]arm64: RME: Propagate number of breakpoints and watchpoints to userspace
  - [v8-33-43]arm64: RME: Hide KVM_CAP_READONLY_MEM for realm guests
  - [v8-32-43]arm64: rme: Enable PMU support with a realm guest
  - [backport]KVM: arm64: PMU: Introduce helpers to set the guest's PMU
  - [backport]KVM: arm64: PMU: Allow userspace to limit PMCR_EL0.N for the guest
  - !17463  crypto: hisilicon/qm - clear the memory before enabling the device
  - [backport]KVM: arm64: PMU: Set PMCR_EL0.N for vCPU  based  on the  associated PMU
  - [v8-31-43]arm_pmu: Provide a mechanism for disabling the physical  IRQ
  - [v8-30-43]arm64: RME: Prevent Device mappings for Realms
  - [v8-29-43]arm64: RME: Always use 4k pages for realms
  - [v8-28-43]arm64: RME: Allow checking SVE on VM instance
  - [v8-27-43]arm64: RME: support RSI_HOST_CALL
  - [v8-26-43]arm64: RME: allow userspace to inject aborts
  - [v8-25-43]arm64: Don't expose stolen time for realm guests
  - [v8-24-43]KVM: arm64: WARN on injected undef exceptions
  - [v8-23-43]KVM: arm64: Handle Realm PSCI requests
  - [v8-22-43]KVM: arm64: Validate register access for a Realm VM
  - [v8-21-43]KVM: arm64: Handle realm VCPU load
  - [v8-20-43]arm64: RME: Runtime faulting of memory
  - [backport]KVM: arm64: Move pagetable definitions to common header
  - [backport]rme: populate guest memory region without guest_memfd
  - [v8-19-43]arm64: RME: Allow populating initial contents
  - [v8-18-43]KVM: arm64: Handle realm MMIO emulation
  - [v8-17-43]arm64: RME: Handle RMI_EXIT_RIPAS_CHANGE
  - [v8-16-43]arm64: RME: Handle realm enter/exit
  - [v8-15-43]arm64: RME: Allow VMM to set RIPAS
  - [backport]KVM: Add member to struct kvm_gfn_range to indicate private/shared
  - [v8-14-43]KVM: arm64: Support timers in realm RECs
  - [v8-13-43]arm64: RME: Support for the VGIC in realms
  - [backport]KVM: arm64: Force GICv3 trap activation when no irqchip  is configured on VHE
  - [v8-12-43]KVM: arm64: vgic: Provide helper for number of list registers
  - [v8-11-43]arm64: RME: Allocate/free RECs to match vCPUs
  - [backport]KVM: arm64: Add generic check for system-supported vCPU features
  - !17467  arm-smmu-v3: adjust ecmdq log level
  - arm-smmu-v3: adjust ecmdq log level
  - crypto: hisilicon/qm - clear the memory before enabling the device
  - [v8-10-43]arm64: RME: RTT tear down
  - [v8-09-43]KVM: arm64: Allow passing machine type in KVM creation
  - [v8-08-43]kvm: arm64: Don't expose debug capabilities for realm  guests
  - [v8-07-43]arm64: RME: ioctls to create and configure  realms
  - [v8-06-43]arm64: RME: Define the user ABI
  - [v8-05-43]arm64: RME: Check for RME support at KVM init
  - [v8-04-43]arm64: RME: Add wrappers for RMI calls
  - [v8-03-43]arm64: RME: Add SMC definitions for calling the RMM
  - [v8-02-43]arm64: RME: Handle Granule Protection Faults (GPFs)
  - [v8-01-43]kvm: arm64: Include kvm_emulate.h in kvm/arm_psci.h
  - Revert "kvm: add virtcca cvm host feature"
  - Revert "VirtCCA: cvm support UEFI boot"
  - Revert "pmu: enable pmu phys irq inject for cvm"
  - !16720 [OLK-6.6] Not print information of SMMU 0x10 event and add phytium PS24080 SoC platform judgement
  - !17458 v2  posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  - ROH: fix variable type inconsistency issue
  - !17441 net: hibmcge: support for statistics of reset failures
  - !17435 arm64/mm: Optimize loop to reduce redundant operations of contpte_ptep_get
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  - net: hibmcge: support for statistics of reset failures
  - sdei_watchdog: use lockup_detector_retry_init() to init sdei watchdog
  - arm64/mm: Optimize loop to reduce redundant operations of contpte_ptep_get
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported
  - atm: Fix NULL pointer dereference
  - LeapIOraid: add device and support fw log
  - iommu: smmuv3: Not print information of SMMU 0x10 event


author: Li Nan <linan122@huawei.com> - 6.6.0-106.0.0.112
changelog:
  - !17565  Enhance soft hwpoison handling and injection
  - !17569  drm/vkms: Fix use after free and double free on init error
  - drm/vkms: Fix use after free and double free on init error
  - !17564  bpf: Reject %p% format string in bprintf-like helpers
  - !17510 PM / devfreq: Add HiSilicon uncore frequency scaling driver
  - !17547  net_sched: drr: Fix double list add in class with netem as child qdisc
  - !17556  filemap: move prefaulting out of hot write path
  - mm/memory-failure: send SIGBUS in the event of thp split fail
  - mm/memory-failure: move hwpoison_filter() higher up
  - mm/memory-failure: improve memory failure action_result messages
  - mm/madvise: add MF_ACTION_REQUIRED to madvise(MADV_HWPOISON)
  - mm/memory-failure: try to send SIGBUS even if unmap failed
  - PM / devfreq: Add HiSilicon uncore frequency scaling driver
  - !17529 mm: optimize mremap() by PTE batching
  - !17481  HID: core: fix __hid_request when no report ID is used
  - bpf: Reject %p% format string in bprintf-like helpers
  - !17495 v2  mm/mem_sampling: preserve kernel subsystem SPE state across perf sampling
  - !17546  net_sched: qfq: Fix double list add in class with netem as child qdisc
  - !17542  net: sch: Fix CVE-2025-37798
  - !17538  wifi: at76c50x: fix use after free access in at76_disconnect
  - !17537  net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
  - !17553 RDMA/hns: Fix dip entries leak on devices newer than hip09
  - filemap: move prefaulting out of hot write path
  - RDMA/hns: Fix dip entries leak on devices newer than hip09
  - RDMA/hns: Fix querying wrong SCC context for DIP algorithm
  - !17479 fix some bugs of enfs
  - !17530  sched/psi: change permissions of /proc/pressure/stat
  - net_sched: drr: Fix double list add in class with netem as child qdisc
  - net_sched: qfq: Fix double list add in class with netem as child qdisc
  - mm/mremap: avoid expensive folio lookup on mremap folio pte batch
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
  - sch_htb: make htb_deactivate() idempotent
  - sch_htb: make htb_qlen_notify() idempotent
  - sch_drr: make drr_qlen_notify() idempotent
  - sch_hfsc: make hfsc_qlen_notify() idempotent
  - sch_qfq: make qfq_qlen_notify() idempotent
  - sch_ets: make est_qlen_notify() idempotent
  - wifi: at76c50x: fix use after free access in at76_disconnect
  - net: vlan: Fix kabi breakage of struct vlan_info
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
  - sched/psi: change permissions of /proc/pressure/stat
  - mm: optimize mremap() by PTE batching
  - !17526 v7  High Performance Container Resource View Isolation -- Stage 2
  - !17515 gpiolib: Get rid of never false gpio_is_valid() calls
  - mm: call pointers to ptes as ptep
  - !17519  CVE-2025-38473
  - !17524  CVE-2025-38375
  - !17517  CVE-2025-38251
  - !17523  CVE-2025-38211
  - samples/bpf: Add iterator program for meminfo
  - bpf-rvi: Add bpf_x86_direct_pages kfunc
  - bpf-rvi: Add bpf_mem_vmalloc_{used,total} kfunc
  - bpf-rvi: Add bpf_mem_commit_limit & bpf_mem_committed kfunc
  - bpf-rvi: Add bpf_mem_percpu kfunc
  - bpf-rvi: Add bpf_mem_failure kfunc
  - bpf-rvi: Add bpf_hugetlb_report_meminfo kfunc
  - bpf-rvi: Add bpf_mem_{total,free}cma kfunc
  - bpf-rvi: Add bpf_mem_{file_{hugepage,pmdmapped},kreclaimable} kfunc
  - samples/bpf: Add iterator program for stat
  - bpf-rvi: stat: Add stat iterator target
  - bpf-rvi: Add kstat_ & kcpustat_ kfuncs
  - bpf-rvi: Add cpu runqueue related kfuncs
  - bpf-rvi: Add stat-related misc kfuncs
  - bpf-rvi: Add bpf_seq_file_append() kfunc
  - samples/bpf: Add iterator program for swaps
  - bpf-rvi: Add bpf_page_counter_read() kfunc
  - bpf-rvi: Add bpf_si_memswinfo() kfunc
  - samples/bpf: Add iterator program for uptime
  - bpf-rvi: cpuacct: Add bpf_task_ca_cpuusage() kfunc
  - samples/bpf: Add iterator program for loadavg
  - bpf-rvi: pidns: Add for_each_task_in_pidns and loadavg-related kfuncs
  - bpf-rvi: pidns: Calculate loadavg for each pid namespace
  - samples/bpf: Add iterator program for partitions
  - bpf-rvi: block: Look up /dev in reaper's fs->root and filter partitions
  - bpf-rvi: block: Add partitions iterator target
  - samples/bpf: Add iterator program for diskstats
  - bpf-rvi: blk-cgroup: Add bpf_blkcg_get_dev_iostat() kfunc
  - bpf-rvi: block: Add diskstats iterator target
  - samples/bpf: Add iterator program for cpuinfo_arm64
  - bpf-rvi: arm64: Add bpf_arch_flags kunc for arm64
  - bpf-rvi: arm64: Add cpuinfo_arm64 iterator target
  - bpf-rvi: arm64: Add bpf_arm64_cpu_have_feature() kfunc
  - bpf-rvi: cpuacct: Add task_cpuacct()
  - bpf-rvi: cpuacct: Add bpf_cpuacct_kcpustat_cpu_fetch kfunc
  - bpf-rvi: proc: add bpf_get_{idle,iowait}_time kfunc
  - bpf-rvi: cgroup: Add cgroup_rstat_flush_atomic() kfunc
  - bpf-rvi: Add bpf_mem_cgroup_from_task() kfunc
  - bpf-rvi: cpuset: Fix missing of return for !tsk in task_effective_cpumask()
  - virtio-net: ensure the received length does not exceed allocated size
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
  - nfs/enfs: make some functions static in enfs_multipath_client.c
  - nfs/enfs: remove enfs_init() and enfs_fini()
  - nfs/enfs: format get_ip_to_str() in shard_route.c
  - nfs/enfs: unlock uniformly at the end of function in shard_route.c
  - nfs/enfs: support debugging ip and dns list
  - nfs/enfs: fix error when showing dns list
  - nfs/enfs: fix alignment between struct rpc_clnt and rpc_clnt_reserve
  - nfs/enfs: set CONFIG_SUNRPC_ENFS=y by default
  - nfs/enfs: fix memory leak of shard_view_ctrl when removing nfs module
  - atm: clip: prevent NULL deref in clip_push()
  - gpiolib: Get rid of never false gpio_is_valid() calls
  - Revert "PM / devfreq: Add HiSilicon uncore frequency scaling driver"
  - mm/mem_sampling: preserve kernel subsystem SPE state across perf sampling
  - HID: core: do not bypass hid_hw_raw_request
  - HID: core: ensure __hid_request reserves the report ID as the first byte
  - HID: core: ensure the allocated report buffer can contain the reserved report ID


author: Li Nan <linan122@huawei.com> - 6.6.0-107.0.0.113
changelog:
  - !17744  trace/fgraph: Fix the warning caused by missing unregister notifier
  - !17737 soc cache: Fix incorrect error path of ioctl
  - !17660  cgroup/cpuset: Support dynamic affinity feature
  - !17293 [OLK-6.6] backport important bugfix for Broadcom BCM57414 nic driver from upstream linux-6.6.y
  - !17747  fix some CVE
  - !17751  iBMA: Fix veth soft lockup by adding DMA-pre-readl sync
  - !17730  arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
  - !16545  KVM: arm64: fix memory leak in TLBI
  - iBMA: Fix veth soft lockup by adding DMA-pre-readl sync
  - !17716  hrtimers: Update new CPU's next event in hrtimers_cpu_dying()
  - !17669  ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
  - !17674  ftrace: Also allocate and copy hash for reading of filter files
  - !17725  perf/core: Don't leak AUX buffer refcount on allocation failure
  - usb: xhci: Fix invalid pointer dereference in Etron workaround
  - thunderbolt: Do not double dequeue a configuration request
  - powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap
  - mm: memory-failure: update ttu flag inside unmap_poisoned_folio
  - Bluetooth: btnxpuart: Fix kernel panic during FW release
  - !17592  ice: add NULL check in eswitch lag check
  - trace/fgraph: Fix the warning caused by missing unregister notifier
  - !17720  crypto: lzo - Fix compression buffer overrun
  - !17719  spi: spi-imx: Add check for spi_imx_setupxfer()
  - !17687  ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
  - soc cache: Fix incorrect error path of ioctl
  - soc cache: Fix incorrect size validation
  - soc cache: Enforce maintain type check
  - !17683 v2  Fix for bpf samples and selftests
  - !17724  mm/dpool: mark dpool hugetlb page as dirty in free_huge_folio()
  - !17438 [OLK-6.6]:update patches for sw64 architecture
  - !17652  wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request
  - !17728  CVE-2025-38006
  - !17677 v2  Fix static check warning reported by coccinelle
  - !17633  dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using
  - !17455  raid10: cleanup memleak at raid10_make_request
  - !17453  md/raid1: Fix stack memory use after return in raid1_reshape
  - arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
  - net: mctp: Don't access ifa_index when missing
  - mctp: no longer rely on net->dev_index_head[]
  - perf/core: Don't leak AUX buffer refcount on allocation failure
  - mm/dpool: mark dpool hugetlb page as dirty in free_huge_folio()
  - !17606  drm/sched: Increment job count before swapping tail spsc queue
  - !17671  bpf-rvi: pidns: fix null-pointer-derefence in pidns_update_load_tasks
  - crypto: lzo - Fix compression buffer overrun
  - spi: spi-imx: Add check for spi_imx_setupxfer()
  - hrtimers: Update new CPU's next event in hrtimers_cpu_dying()
  - !17632  perf/core: Exit early on perf_mmap() fail
  - ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
  - samples/bpf: Move bpf_rvi_* progs to bpf_rvi directory
  - selftests/bpf: fix perf_event link info name_len assertion
  - Revert "selftests/bpf: Use bpf_link__destroy in fill_link_info tests"
  - Revert "selftests/bpf: Add cookies check for perf_event fill_link_info test"
  - Revert "selftests/bpf: fix perf_event link info name_len assertion"
  - !17650 net: phy: motorcomm: Add support for PHY LEDs on YT8521
  - !17634  HID: pidff: Fix null pointer dereference in pidff_find_fields
  - ACPI / MPAM: Fix wrong IS_ERR() check in _parse_table()
  - hiroce3: Use IS_ERR() to check the return value of kthread_run()
  - ftrace: Also allocate and copy hash for reading of filter files
  - bpf-rvi: pidns: fix null-pointer-derefence in pidns_update_load_tasks
  - !17642  tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
  - !17641  net: clear the dst when changing skb protocol
  - !17653  wifi: iwlwifi: fix debug actions order
  - !17651  wifi: mt76: disable napi on driver removal
  - !17647  CVE-2025-38052
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
  - cgroup/cpuset: Support dynamic affinity feature
  - !17646  sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
  - !17648  CVE-2025-37920
  - !17643  net: Fix TOCTOU issue in sk_is_readable()
  - !17644  bridge: mcast: Fix use-after-free during router port configuration
  - !17645  CVE-2025-38465
  - !17600  two bugfix for arm64 support HVO
  - !17649  Fix CVE-2025-21839
  - !17628  Fix CVE-2025-37780
  - !17629  Fix CVE-2025-37767
  - !17637  netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
  - !17638  tcp: Correct signedness in skb remaining space calculation
  - !17639  tipc: Fix use-after-free in tipc_conn_close().
  - !17640  seg6: Fix validation of nexthop addresses
  - wifi: iwlwifi: fix debug actions order
  - wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request
  - wifi: mt76: disable napi on driver removal
  - net: phy: motorcomm: Add support for PHY LEDs on YT8521
  - !17608  mm/util: make memdup_user_nul() similar to memdup_user()
  - net: hns3: change the function return type from int to bool
  - KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop
  - xsk: Fix kabi broken
  - xsk: Fix race condition in AF_XDP generic RX path
  - net: tipc: fix refcount warning in tipc_aead_encrypt
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
  - netlink: avoid infinite retry looping in netlink_unicast()
  - netlink: make sure we allow at least one dump skb
  - netlink: Fix rmem check in netlink_broadcast_deliver().
  - netlink: Fix wraparounds of sk->sk_rmem_alloc.
  - bridge: mcast: Fix use-after-free during router port configuration
  - net: Fix TOCTOU issue in sk_is_readable()
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
  - net: clear the dst when changing skb protocol
  - seg6: Fix validation of nexthop addresses
  - tipc: Fix use-after-free in tipc_conn_close().
  - tcp: Correct signedness in skb remaining space calculation
  - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
  - HID: pidff: Fix null pointer dereference in pidff_find_fields
  - dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using
  - !17597 Delete PHYTIUM_CPU_PART_FTC862 macro
  - perf/core: Exit early on perf_mmap() fail
  - drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero
  - isofs: Prevent the use of too small fid
  - !17307  scsi: megaraid_sas: Fix invalid node index
  - !17309  irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
  - mm/util: make memdup_user_nul() similar to memdup_user()
  - drm/sched: Increment job count before swapping tail spsc queue
  - !17575  net/sched: Fix CVE-2025-37890
  - arm64: mm: HVO: fix deadlock in split vmemmap pmd
  - mm: HVO: fix hard lockup in split_vmemmap_huge_pmd under x86
  - cputype: phytium: Delete PHYTIUM_CPU_PART_FTC862 macro
  - ice: add NULL check in eswitch lag check
  - !16528 [OLK-6.6] dma: phytium: Add PSWIOTLB mechanism to improve DMA performance
  - !17570  tracing: Add down_write(trace_event_sem) when adding trace event
  - net/sched: ets: use old 'nbands' while purging unused classes
  - net/sched: Always pass notifications when child class becomes empty
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
  - tracing: Add down_write(trace_event_sem) when adding trace event
  - sw64: ptrace: return -EIO in invalid PEEKUSR/POKEUSR requests
  - sw64: kvm: fix missing kvm_unregister_perf_callbacks
  - sw64: kvm: fix compile error of kvm.ko
  - sw64: kvm: remove the duplicated Kconfig selection of KVM
  - sw64: cpuidle: add dedicated driver
  - sw64: fix missing characters for sw64_rrk
  - sw64: selftests/net: add sw64 support for io_uring_zerocopy_tx
  - sw64: crypto: implement crc32 assembly optimization
  - sw64: efi: remove meaningless code from asm/efi.h
  - sw64: fix incorrect macro definitions for sw64 in bpf_tracing.h
  - sw64: cpufreq: using PLL0 to provide clock for idle cores
  - sw64: kvm: save the virtual address of irqs_pending in vcpucb
  - sw64: kvm: fix undefined error with ftrace disabled
  - raid10: cleanup memleak at raid10_make_request
  - md/raid1: Fix stack memory use after return in raid1_reshape
  - sw64: kvm: enable dirty log gradually in small chunks for core4
  - sw64: fix guest kdump function
  - sw64: ftrace: add HAVE_DYNAMIC_FTRACE_WITH_ARGS support
  - sw64: use wait/complete for smp boot
  - sw64: fix sw64_rrk_store() wrap handling
  - irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
  - scsi: megaraid_sas: Fix invalid node index
  - bnxt: properly flush XDP redirect lists
  - dma: phyitum: enable CONFIG_PHYTIUM_ERRATUM_FT3386
  - dma: Fix kabi breakage due to "dma: pswiotlb: Move platform-identification to cpu errata"
  - dma: pswiotlb: Move platform-identification to cpu errata
  - dma: pswiotlb: Move pswiotlb dma functions behind dma_map_ops
  - dma: phyitum: enable CONFIG_PSWIOTLB
  - dma: Fix kabi breakage due to "dma: phytium: Add PSWIOTLB mechanism to improve DMA performance"
  - dma: phytium: Add PSWIOTLB mechanism to improve DMA performance
  - KVM: arm64: fix memory leak in TLBI


author: Li Nan <linan122@huawei.com> - 6.6.0-108.0.0.114
changelog:
  - !17835 v2  perf/aux: Fix pending disable flow when the AUX ring buffer overruns
  - !17856  sdei_watchdog: add percpu flag to fix sdei watchdog state in lpi mode
  - !17635 mm: madvise: use per_vma lock for MADV_FREE
  - sdei_watchdog: add percpu flag to fix sdei watchdog state in lpi mode
  - !17841  fs/resctrl: Fix max_threshold_occupancy write operation
  - !17844  CVE-2025-37752
  - !17845  xfrm: interface: fix use-after-free after changing collect_md xfrm interface
  - !17733  proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
  - !17834  cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
  - xfrm: interface: fix use-after-free after changing collect_md xfrm interface
  - net_sched: sch_sfq: move the limit validation
  - net_sched: sch_sfq: use a temporary work area for validating configuration
  - !17840  arm64/mpam: Fix num_rmids when enable CDP mode
  - fs/resctrl: Fix max_threshold_occupancy write operation
  - arm64/mpam: Fix num_rmids when enable CDP mode
  - !17838  mm/hugetlb: fix set_max_huge_pages() when there are surplus pages
  - mm/hugetlb: fix set_max_huge_pages() when there are surplus pages
  - !17587 CVE-2025-38406: wifi: ath6kl: remove WARN on bad firmware input
  - !17585 CVE-2025-38408： genirq/irq_sim: Initialize work context pointers properly
  - !17586 CVE-2025-38409: drm/msm: Fix another leak in the submit error path
  - !17584 CVE-2025-38410: drm/msm: Fix a fence leak in submit error path
  - !17582 NFC: nci: uart: Set tty-&gt;disc_data only in success path
  - !17590 wifi: carl9170: do not ping device which has failed to load firmware
  - !17593 net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
  - !17594 CVE-2025-38425: i2c: tegra: check msg length in SMBUS block read
  - !17595 Input: ims-pcu - check record size in ims_pcu_flash_firmware()
  - !17596 usb: gadget: u_serial: Fix race condition in TTY wakeup
  - !17583 CVE-2025-38467：drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
  - perf/aux: Fix pending disable flow when the AUX ring buffer overruns
  - cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
  - !17789  bpf, sockmap: Fix CVE-2025-38154
  - !17712  wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
  - !17790  page_pool: Fix use-after-free in page_pool_recycle_in_ring
  - !17788  netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
  - !17786  net: xfrm: Fix CVE-2025-38097
  - !17784  bpf, sockmap: Fix panic when calling skb_linearize
  - !17785  bpf: fix ktls panic with sockmap
  - !17783  net/sched: fix use-after-free in taprio_dev_notifier
  - !17781  mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices
  - !17782  net/mlx5e: Disable MACsec offload for uplink representor profile
  - !17780  RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem
  - !17779  RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  - !17778  phy: tegra: xusb: remove a stray unlock
  - !17777  net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled
  - !17776  dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn
  - !17775  espintcp: fix skb leaks
  - !17774  can: bcm: add locking for bcm_op runtime updates
  - !17711  net: lan743x: Fix memleak issue when GSO enabled
  - !17708  net: phy: Fix CVE-2025-37945
  - !17707  bpf: Scrub packet on bpf_redirect_peer
  - !17703  9p/net: fix improper handling of bogus negative read/write replies
  - !17699  netfilter: socket: Lookup orig tuple for IPv6 SNAT
  - !17685  gtp: Fix CVE-2025-21678
  - !17816  vmci: Prevent the dispatching of uninitialized payloads
  - !17824  tracing/probes: Avoid using params uninitialized in parse_btf_arg()
  - !17609 cpufreq: Exit governor when failed to start old governor
  - !17823  arm64/mpam: Fix the logic that determines whether an MPAM MSC should initialize
  - tracing/probes: Avoid using params uninitialized in parse_btf_arg()
  - !17821  mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
  - arm64/mpam: Fix the logic that determines whether an MPAM MSC should initialize
  - mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
  - !17818  fix some CVEs
  - !17798  benet: fix BUG when creating VFs
  - mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list
  - mm/vmscan: don't try to reclaim hwpoison folio
  - platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
  - memblock: Accept allocated memory before use in memblock_double_array()
  - KVM: x86: Reset IRTE to host control if *new* route isn't postable
  - scsi: mpi3mr: Fix possible crash when setting up bsg fails
  - Input: synaptics - use guard notation when pausing serio port
  - vmci: Prevent the dispatching of uninitialized payloads
  - !17804  pinmux: fix race causing mux_owner NULL with active mux_usecount
  - !17800  gic: increase the arch_timer
  - !17794  perf/core: Prevent VMA split of buffer mappings
  - !17574 ROH: Add crc_err_cnt and retry_cnt mib statistics
  - pinmux: fix race causing mux_owner NULL with active mux_usecount
  - !17337 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.64-6.6.66 LTS Conflicts Patches
  - !17797 v3  HiSock Redirect Framework
  - gic: increase the arch_timer priority to avoid hardlockup
  - benet: fix BUG when creating VFs
  - !17768  net/oenetcls: introduce oenetcls for network optimization
  - ROH: Add crc_err_cnt and retry_cnt mib statistics
  - samples/bpf: Add HiSock Redirect sample
  - openeuler_defconfig: Enable CONFIG_HISOCK
  - bpf: Add bpf_*_change_dev kfunc
  - bpf: Add bpf_xdp_set_ingress_dst kfunc
  - bpf: Add hisock_xdp_buff wrapper for xdp_buff
  - bpf: Add bpf_skops_get_ingress_dst kfunc
  - bpf: Enable generic kfuncs for BPF_CGROUP_* programs
  - bpf: Add HISOCK_EGRESS hook on network egress path
  - bpf: Add BPF_PROG_TYPE_HISOCK prog type
  - bpf: Add XDP_HISOCK_REDIRECT action
  - bpf: Add CONFIG_HISOCK
  - !17470  fix CVE-2025-38351
  - !17766 RDMA/hns: Fix bond not cleared when the configuration becomes invalid
  - !17772  two CVE fix
  - perf/core: Prevent VMA split of buffer mappings
  - !17659 v2  sched: More flexible use of CPU quota when CPU is idle
  - !17748  fix bug in hdbss
  - page_pool: Fix use-after-free in page_pool_recycle_in_ring
  - bpf, sockmap: Avoid using sk_socket after free when sending
  - bpf, sockmap: fix duplicated data transmission
  - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
  - net: xfrm: Fix kabi breakage of struct xfrm_state
  - espintcp: remove encap socket caching to avoid reference leak
  - !17294 [OLK-6.6] backport important bugfix for lpfc driver from upstream linux-6.6.y
  - !17714  can: bcm: add missing rcu read protection for procfs content
  - !17713  net: phy: leds: fix memory leak
  - !17717  ipvs: fix uninit-value for saddr in do_output_route4
  - !17706  RDMA/cma: Fix CVE-2025-37772
  - !17709  bnxt_en: Fix CVE-2025-37911
  - !17705  igc: fix PTM cycle trigger logic
  - !17718  ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr()
  - !17701  net: openvswitch: fix nested key length validation in the set() action
  - !17702  net: ppp: Add bound checking for skb data on ppp_sync_txmung
  - !17704  page_pool: avoid infinite loop to schedule delayed worker
  - !17700  wifi: mac80211: Purge vif txq in ieee80211_do_stop()
  - !17697  netfilter: nft_tunnel: fix geneve_opt type confusion addition
  - !17715  netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
  - !17696  net: decrease cached dst counters in dst_release
  - !17695  netfilter: nf_tables: don't unregister hook when table is dormant
  - !17694  RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
  - !17693  drm/connector: Fix CVE-2025-22089
  - !17692  vmxnet3: unregister xdp rxq info in the reset path
  - !17690  Bluetooth: Fix error code in chan_alloc_skb_cb()
  - !17689  tcp: Fix CVE-2025-21864
  - !17741  Fix trace may OOB when trace_get_user failed
  - !17742  i2c: qup: jump out of the loop in case of timeout
  - !17678  dm cache: prevent BUG_ON by blocking retries on failed device resumes
  - !17679  media: cx231xx: set device_caps for 417
  - bpf: fix ktls panic with sockmap
  - bpf, sockmap: Fix panic when calling skb_linearize
  - net/sched: fix use-after-free in taprio_dev_notifier
  - net/mlx5e: Disable MACsec offload for uplink representor profile
  - mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  - phy: tegra: xusb: remove a stray unlock
  - net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled
  - dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn
  - espintcp: fix skb leaks
  - can: bcm: add locking for bcm_op runtime updates
  - net: libwx: fix the using of Rx buffer DMA
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
  - !9218 [OLK-6.6] i2c/zhaoxin: I2C controller driver enhancement and optimization
  - !17755  arm64: perf: Add support for HIP12 hw metric
  - !17763  mm/smaps: fix race between smaps_hugetlb_range and migration
  - net/oenetcls: introduce oenetcls for network optimization
  - RDMA/hns: Fix bond not cleared when the configuration becomes invalid
  - mm/smaps: fix race between smaps_hugetlb_range and migration
  - fs/proc/task_mmu: convert smaps_hugetlb_range() to work on folios
  - i2c: zhaoxin: Add support for Zhaoxin I2C controller
  - arm64: perf: Add support for HIP12 hw metric
  - KVM: arm64: fix memory leak in HDBSS
  - KVM: arm64: do not support hdbss in nvhe
  - i2c: qup: jump out of the loop in case of timeout
  - tracing: Limit access to parser->buffer when trace_get_user failed
  - tracing: Remove unneeded goto out logic
  - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
  - ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr()
  - ipvs: fix uninit-value for saddr in do_output_route4
  - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
  - can: bcm: add missing rcu read protection for procfs content
  - net: phy: leds: fix memory leak
  - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
  - net: lan743x: Fix memleak issue when GSO enabled
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w
  - bnxt_en: Fix coredump logic to free allocated buffer
  - genirq/irq_sim: Initialize work context pointers properly
  - net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY
  - net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend()
  - bpf: Scrub packet on bpf_redirect_peer
  - RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work
  - RDMA/cma: Fix workqueue crash in cma_netevent_work_handler
  - igc: fix PTM cycle trigger logic
  - page_pool: avoid infinite loop to schedule delayed worker
  - 9p/net: fix improper handling of bogus negative read/write replies
  - net: ppp: Add bound checking for skb data on ppp_sync_txmung
  - net: openvswitch: fix nested key length validation in the set() action
  - wifi: mac80211: Purge vif txq in ieee80211_do_stop()
  - netfilter: socket: Lookup orig tuple for IPv6 SNAT
  - netfilter: nft_tunnel: fix geneve_opt type confusion addition
  - net: decrease cached dst counters in dst_release
  - netfilter: nf_tables: don't unregister hook when table is dormant
  - RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
  - drm/connector: fix kabi broken in struct ib_device
  - RDMA/core: Don't expose hw_counters outside of init net namespace
  - vmxnet3: unregister xdp rxq info in the reset path
  - Bluetooth: Fix error code in chan_alloc_skb_cb()
  - net: use __GENKSYMS__ to revert the kabi change
  - tcp: drop secpath at the same time as we currently drop dst
  - gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
  - gtp: Destroy device along with udp socket's netns dismantle.
  - media: cx231xx: set device_caps for 417
  - dm cache: prevent BUG_ON by blocking retries on failed device resumes
  - sched: More flexible use of CPU quota when CPU is idle
  - mm: fix the race between collapse and PT_RECLAIM under per-vma lock
  - mm: madvise: use per_vma lock for MADV_FREE
  - mm: use per_vma lock for MADV_DONTNEED
  - mm: madvise: use walk_page_range_vma() instead of walk_page_range()
  - cpufreq: Exit governor when failed to start old governor
  - cpufreq: Move the check of cpufreq_driver->get into cpufreq_verify_current_freq()
  - cpufreq: Init policy->rwsem before it may be possibly used
  - cpufreq: Initialize cpufreq-based frequency-invariance later
  - cpufreq: Hold cpufreq_driver_lock when assigning cpufreq_driver->set_boost
  - cpufreq: Remove duplicate check in __cpufreq_offline()
  - cpufreq: Contain scaling_cur_freq.attr in cpufreq_attrs
  - cpufreq: CPPC: Remove forward declaration of cppc_cpufreq_register_em()
  - cpufreq: CPPC: Do not return a value from populate_efficiency_class()
  - cpufreq: CPPC: Remove cpu_data_list
  - cpufreq: CPPC: Remove forward declaration of hisi_cppc_cpufreq_get_rate()
  - cpufreq: cppc: Fix invalid return value in hisi_cppc_cpufreq_get_rate()
  - cpufreq: cppc: Fix invalid return value in .get() callback
  - i2c: tegra: check msg length in SMBUS block read
  - drm/msm: Fix another leak in the submit error path
  - wifi: ath6kl: remove WARN on bad firmware input
  - KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
  - KVM: x86: model canonical checks more precisely
  - KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks
  - KVM: x86: Route non-canonical checks in emulator through emulate_ops
  - KVM: x86: drop x86.h include from cpuid.h
  - KVM: x86: Bury guest_cpuid_is_amd_or_hygon() in cpuid.c
  - KVM: SVM: Emulate SYSENTER RIP/RSP behavior for all Intel compat vCPUs
  - KVM: x86: Inhibit code #DBs in MOV-SS shadow for all Intel compat vCPUs
  - KVM: x86: Apply Intel's TSC_AUX reserved-bit behavior to Intel compat vCPUs
  - KVM: x86/pmu: Squash period for checkpointed events based on host HLE/RTM
  - ALSA: hda: Fix build error without CONFIG_SND_DEBUG
  - ALSA: hda/conexant: Use the new codec SSID matching
  - ALSA: hda: Use own quirk lookup helper
  - scsi: lpfc: Use memcpy() for BIOS version
  - Input: ims-pcu - check record size in ims_pcu_flash_firmware()
  - usb: gadget: u_serial: Fix race condition in TTY wakeup
  - net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
  - wifi: carl9170: do not ping device which has failed to load firmware
  - drm/msm: Fix a fence leak in submit error path
  - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
  - NFC: nci: uart: Set tty->disc_data only in success path


author: Li Nan <linan122@huawei.com> - 6.6.0-109.0.0.115
changelog:
  - !17945  Fix CVE-2025-38687
  - !17936  padata: Fix pd UAF once and for all
  - !17879 sched: apply custom cpu range for idle cpu
  - comedi: fix race between polling and detaching
  - !17937  clk: davinci: Add NULL check in davinci_lpsc_clk_register()
  - clk: davinci: Add NULL check in davinci_lpsc_clk_register()
  - padata: Fix pd UAF once and for all
  - !17853 v3  arm64: Fix actlr_el1 can not set problem in guest
  - !17882  CVE-2025-38502
  - !17922  x86/sgx: Prevent attempts to reclaim poisoned pages
  - !17923  media: vidtv: Terminating the subsequent process of initialization failure
  - !17924 [backport]KVM: arm64: Select default PMU in KVM_ARM_VCPU_INIT handler
  - !17913  Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
  - !17915  arm64/mpam: Half the number of RMIDs for all resources under CDP mode
  - [backport]KVM: arm64: Select default PMU in KVM_ARM_VCPU_INIT handler
  - media: vidtv: Terminating the subsequent process of initialization failure
  - x86/sgx: Prevent attempts to reclaim poisoned pages
  - !17848 [OLK-6.6]:update patches for sw64 architecture
  - !17731  arm64/mpam: Add mb_only boot option
  - !17911  CVE-2025-38305
  - !17244  Fix netns reference count issue
  - !17914 virtCCA CoDA: Expose I/O hook interfaces.
  - virtCCA CoDA: Expose I/O hook interfaces.
  - arm64/mpam: Half the number of RMIDs for all resources under CDP mode
  - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
  - ptp: fix breakage after ptp_vclock_in_use() rework
  - ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()
  - !17868  scsi: Remove scsi device no_start_on_resume flag
  - !17866  md: make rdev_addable usable for rcu mode
  - !17865  scsi: core: ufs: Fix a hang in the error handler
  - !17842 [OLK-6.6] Fix CVE-2025-37924
  - !17836 [OLK-6.6] Fix CVE-2025-38312
  - !17902 [OLK-6.6] perf/zhaoxin/uncore: Enhance uncore support and fix related bugs
  - !17880 [OLK-6.6] backport important bugfix for lpfc driver from upstream linux-6.6.y
  - perf/zhaoxin/uncore: Enhance uncore support and fix related bugs
  - !17890  LeapIOraid: fix strscpy size argument
  - !17892  pptp: Fix skb length handling and error path in pptp_xmit()
  - !17815 v2  ext4: better scalability for ext4 block allocation
  - pptp: fix pptp_xmit() error path
  - pptp: ensure minimal skb length in pptp_xmit()
  - LeapIOraid: fix strscpy size argument
  - !17883  net/mlx5e: Remove skb secpath if xfrm state is not found
  - net/mlx5e: Remove skb secpath if xfrm state is not found
  - Fix kabi breakage for bpf_map by using KABI_BROKEN_REPLACE and KABI_FILL_HOLE.
  - bpf: Fix oob access in cgroup local storage
  - bpf: Move cgroup iterator helpers to bpf.h
  - bpf: Move bpf map owner out of common struct
  - bpf: Add cookie object to bpf maps
  - sched: apply custom cpu range for idle cpu
  - !17756 [OLK-6.6] Provide host-side administrators/users with real-time access to the usage status of CSV3 CMA memory.
  - !17846  VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
  - !17442  scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
  - !17813  net/mlx5: Check device memory pointer before usage
  - scsi: fix kabi broken for no_start_on_resume flag in struct scsi_device
  - scsi: Remove scsi device no_start_on_resume flag
  - md: make rdev_addable usable for rcu mode
  - scsi: core: ufs: Fix a hang in the error handler
  - sw64: fix for userspace asking for syscall(-1)
  - sw64: update junzhang default config file
  - sw64: kvm: introduce pmd_thp_or_huge for PMD hugepage checking
  - sw64: add cross-page check in software unaligned write handling
  - sw64: ptrace: fail system calls on invalid address access in PEEKUSR
  - sw64: ptrace: fix a bug in return value handling in PEEKUSR AND POKEUSR
  - sw64: perf: Add support for get_cpuid_str function
  - sw64: kvm: use read/write spin lock for KVM MMU
  - sw64: rethook: fix a bug in rethook_trampoline
  - sw64: perf unwind: Do not put libunwind-sw_64 in FEATURE_TESTS_BASIC
  - arm64: Fix actlr_el1 can not set problem in guest
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
  - ksmbd: fix use-after-free in kerberos authentication
  - ksmbd: Fix dangling pointer in krb_authenticate
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
  - ext4: fix potential null deref in ext4_mb_init()
  - ext4: implement linear-like traversal across order xarrays
  - ext4: refactor choose group to scan group
  - ext4: open coding repeated check in next_linear_group
  - ext4: use correct criteria name instead stale integer number in comment
  - ext4: remove unused parameter ngroup in ext4_mb_choose_next_group_*()
  - ext4: convert free groups order lists to xarrays
  - ext4: factor out ext4_mb_scan_group()
  - ext4: factor out ext4_mb_might_prefetch()
  - ext4: keep "prefetch_grp" and "nr" consistent
  - ext4: remove unused ext4_allocation_context::ac_groups_considered
  - ext4: factor out __ext4_mb_scan_group()
  - ext4: convert EXT4_B2C(sbi->s_stripe) users to EXT4_NUM_B2C
  - ext4: fallback to complex scan if aligned scan doesn't work
  - ext4: fix largest free orders lists corruption on mb_optimize_scan switch
  - ext4: fix zombie groups in average fragment size lists
  - ext4: merge freed extent with existing extents before insertion
  - ext4: convert sbi->s_mb_free_pending to atomic_t
  - ext4: make running and commit transaction have their own freed_data_list
  - ext4: fix typo in CR_GOAL_LEN_SLOW comment
  - ext4: get rid of some obsolete EXT4_MB_HINT flags
  - ext4: utilize multiple global goals to reduce contention
  - ext4: remove unnecessary s_md_lock on update s_mb_last_group
  - ext4: remove unnecessary s_mb_last_start
  - ext4: separate stream goal hits from s_bal_goals for better tracking
  - Revert "ext4: move mb_last_[group|start] to ext4_inode_info"
  - ext4: add ext4_try_lock_group() to skip busy groups
  - net/mlx5: Check device memory pointer before usage
  - x86/csv: Add function to get free size of CSV3 CMA
  - arm64/mpam: Add mb_only boot option
  - scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
  - smb: client: fix netns refcount leak after net_passive changes
  - Revert "smb: client: fix TCP timers deadlock after rmmod"
  - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"


author: Li Nan <linan122@huawei.com> - 6.6.0-110.0.0.116
changelog:
  - !18015 arm64: cca_base: On the Adaptation of CCA and virtCCA.
  - arm64: cca_base: On the Adaptation of CCA and virtCCA.
  - !18017  pNFS: Fix uninited ptr deref in block/scsi layout
  - pNFS: Fix uninited ptr deref in block/scsi layout
  - !18000  gfs2: Validate i_depth for exhash directories
  - !17997  hv_netvsc: Fix panic during namespace deletion with VF
  - !17947  migration/hisilicon: some bugfix
  - !17919  nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
  - gfs2: Validate i_depth for exhash directories
  - hv_netvsc: Fix panic during namespace deletion with VF
  - !17985  Updates of HiSilicon Uncore L3C PMU
  - !17977  media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
  - !17987 virtCCA CoDA: Prevent secure PFs/VFs load or probe native drivers.
  - virtCCA CoDA: Prevent secure PFs/VFs load or probe native drivers.
  - Documentation: hisi-pmu: Add introduction to HiSilicon V3 PMU
  - Documentation: hisi-pmu: Fix of minor format error
  - drivers/perf: hisi: Add support for L3C PMU v3
  - !17974 iommu: Fix the incorrect exception process of the failed memory allocation
  - !17983  fix oenetcls bugs
  - net/oenetcls: clean resource when init ntuple/flow fail
  - net/oenetcls: use workqueue for ntuple cfg
  - net/oenetcls: remove oenetcls trace hook
  - net/oenetcls: use raw_smp_processor_id() instead of smp_processor_id()
  - !17898 enfs: fix some bugs and optimize performance
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
  - !17976  LoongArch: BPF: Fix jump offset calculation in tailcall
  - iommu: Fix the incorrect exception process of the failed memory allocation
  - LoongArch: BPF: Fix jump offset calculation in tailcall
  - !17602 [OLK-6.6] drm/phytium: Fix make allmodconfig build fail
  - !17792 virtCCA: Improve cvm performance.
  - !17869 [OLK-6.6]Backport upstream CC Measurement support in the efi libstub
  - !17862 [OLK-6.6]Hygon: Support RTMR and Attestation that includes RTMR for Hygon CSV3 VM
  - !17946 mm/shmem, swap: bugfix and improvement of mTHP swap in
  - !17969  arm64/mpam: Add quirk for cmax and cmin
  - !17967  sched: Fix sched_numa_find_nth_cpu() if mask offline
  - !17955 arm64: RME: handle RIPAS changes before kvm_rec_enter
  - arm64: RME: handle RIPAS changes before kvm_rec_enter
  - arm64: RME: Introduce kvm_rec_pre_enter() called before entering an atomic section
  - !17962  tools/mpam: Add MPAM dynamic adjustment and sampling scripts
  - arm64/mpam: Add quirk for cmax and cmin
  - !17940  net/tls: fix kernel panic when alloc_page failed
  - !17941  OLK-6.6-fix-CVE-2025-38147
  - sched: Fix sched_numa_find_nth_cpu() if mask offline
  - tools/mpam: Add MPAM dynamic adjustment and sampling scripts
  - !17939  pinctrl: qcom: msm: mark certain pins as invalid for interrupts
  - hisi_acc_vfio_pci: update device driver status
  - migration: resolve duplicate migration states
  - migration: fix VF reset timeout issue
  - migration: bugfix live migration function without VF device driver
  - mm/shmem, swap: fix major fault counting
  - mm/shmem, swap: rework swap entry and index calculation for large swapin
  - mm/shmem, swap: simplify swapin path and result handling
  - mm/shmem, swap: never use swap cache and readahead for SWP_SYNCHRONOUS_IO
  - mm/shmem, swap: tidy up swap entry splitting
  - mm/shmem, swap: tidy up THP swapin checks
  - mm/shmem, swap: avoid redundant Xarray lookup during swapin
  - mm/shmem, swap: improve cached mTHP handling and fix potential hang
  - mm/shmem, swap: fix softlockup with mTHP swapin
  - Add IPI direct inject method for virtCCA CVM.
  - Improve virtCCA CVM vtimer irq inject method.
  - Add poll method for nfs for virtCCA CVM.
  - calipso: unlock rcu before returning -EAFNOSUPPORT
  - calipso: Don't call calipso functions for AF_INET sk.
  - net/tls: fix kernel panic when alloc_page failed
  - pinctrl: qcom: msm: mark certain pins as invalid for interrupts
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
  - nfs/enfs: remove duplicate definitions
  - nfs/enfs: fix some cleanup issues
  - nfs/enfs: fix finding root uuid issue
  - nfs/enfs: introduce is_enfs_debug()
  - nfs/enfs: get rpc procedure number from rpc_procinfo in get_uuid_from_task()
  - sunrpc: do not set enfs transport in rpc_task_set_client()
  - efi/libstub: Add get_event_log() support for CC platforms
  - efi/libstub: Measure into CC protocol if TCG2 protocol is absent
  - efi/libstub: Add Confidential Computing (CC) measurement typedefs
  - efi/tpm: Use symbolic GUID name from spec for final events table
  - efi/libstub: Use TPM event typedefs from the TCG PC Client spec
  - virt: csv-guest: Add support for extended attestation aware request in the CSV3 guest
  - virt: csv-guest: Implement CSV RTMR ioctl interfaces
  - virt: csv-guest: Introduce CSV RTMR uapi interface
  - x86/csv: Introduce RTMR interfaces
  - Add dynamic wfx trap method for virtCCA CVM.
  - drm/phytium: Fix Phytium DRM build fail


author: xingwei <xingwei14@h-partners.com> - 8.4.0-16
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:altsvc: avoid integer overflow in expire calculation
         urlapi: fix redirect to a new fragment or query (only)
         tool_getparam: clear sensitive arguments better


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-17
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libssh: fix freeing of resources in disconnect
         openssl: fix crash on missing cert password


author: wangshuo <wangshuo@kylinos.cn> - 1.21.4-29
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:crypto/tls: fix Config.Time in tests using expired certificates


author: Vanient <xiadanni1@huawei.com> - 1.21.4-30
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: allow update of system stack bounds on callback from C thread


author: yaoxin <yao_xin001@hoperun.com> - 1.20.3-3
changelog:
  - Fix cves:
    CVE-2024-47606,CVE-2024-47599,CVE-2024-47613,CVE-2024-47775
    CVE-2024-47776,CVE-2024-47777,CVE-2024-47778,CVE-2024-47774
    CVE-2024-47540,CVE-2024-47602,CVE-2024-47601,CVE-2024-47603
    CVE-2024-47834,CVE-2024-47537,CVE-2024-47597,CVE-2024-47543
    CVE-2024-47596,CVE-2024-47539,CVE-2024-47546,CVE-2024-47598


author: renmingshuai <renmingshuai@huawei.com> - 0.10.5-2
changelog:
  - Type:CVE
  - Id:CVE-2023-6004,CVE-2023-48795,CVE-2023-6918
  - SUG:NA
  - DESC:fix CVE-2023-6004,CVE-2023-48795 and CVE-2023-6918


author: zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-5
changelog:
  - Type:CVE
  - Id:CVE-2025-4877 CVE-2025-4878 CVE-2025-5351 CVE-2025-5987 CVE-2025-5372
  - SUG:NA
  - DESC:fix CVE-2025-4877CVE-2025-4878CVE-2025-5351CVE-2025-5987CVE-2025-5372


author: gengqihu <gengqihu2@h-partners.com> - 23.3.1-1
changelog:
  - update version to 23.3.1
  - Fix parallel pip cache downloads causing crash (#12364)
  - Upgrade urllib3 to 1.26.17 (#12343)
  - Fix zsh completion script (#12173)
  - Fix #12166
  - Move the setuptools settings into pyproject.toml
  - Use `-r=...` instead of `-r ...` for hg
  - Drop isort and flake8 settings from setup.cfg
  - Follow imports for more vendored dependencies
  - Enable mypy's strict equality checks (#12209)
  - Fixed argument name in docstring
  - Allow truststore to not import on Python 3.9 and earlier
  - Vendor truststore
  - Fix formatting, combine numbers not strings!
  - Remove uses of `utcnow` in non-vendored code (#12006)
  - Fix issues raised in code review
  - move test_download_metadata mock pypi index utilities to conftest.py
  - Use strict optional checking in req_install.py (#11379)
  - Fix 'force' remove file without write permissions
  - Dropped unused attribute
  - Fix Pytest --use-venv init
  - Limit the double download fix to wheels
  - Fix slowness on Python 3.11 when updating an existing large environment.
  - Fix `pip completion --zsh`


author: xinsheng <xinsheng3@huawei.com> - 3.11.6-7
changelog:
  - Type:CVE
  - CVE:CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597
  - SUG:NA
  - DESC:fix CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597
      - rename all CVE patch name
      - CVE-2024-6232: Remove backtracking when parsing tarfile headers
      - CVE-2024-3219: patch1 Authenticate socket connection for `socket.socketpair()` fallback
      - CVE-2024-3219: patch2 Rework pure Python socketpair tests to avoid use of importlib.reload.
      - CVE-2024-0450: Protect zipfile from "quoted-overlap" zipbomb
      - CVE-2023-6597: tempfile.TemporaryDirectory: fix symlink bug in cleanup


author: Funda Wang <fundawang@yeah.net> - 3.11.6-8
changelog:
  - Type:CVE
  - CVE:CVE-2024-9287
  - SUG:NA
  - DESC:fix CVE-2024-9287
    - Quote template strings in venv activation scripts


